d6caa4c039b8ecfb65d057bc74c5b458dec8975a7a192c9a851f769f4c8c476c

Analysis

max time kernel
598s
max time network
474s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
10/11/2026, 13:59

Target
IdleOS/IdleOS/steam_settings/configs.user.ini
Size 50B
Sample261110-ramdaaax2l
SHA256 d6caa4c039b8ecfb65d057bc74c5b458dec8975a7a192c9a851f769f4c8c476c
MD5 918740a514479845970385f08627dd65
SHA1 501603e95c850c10efcce7e82c1e3b386ceb6da4
SHA512 32f00d1ef3b190af062f814c8e32f45e410a73fbda51a89c0ed63bcc2bbbddf6ca4e6013c37d0ab4e94b9d7039d90c46dcc8a4fecda0767a478d0c2f03357c57
TLSH
T122900221085050665CB1142270833D09039551F560066D590280350651A5A210855691
MD5 SHA1 SHA512 TLSH

Score

1^/10

ransomware

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
5612	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\IdleOS\IdleOS\steam_settings\configs.user.ini
1⤵
- Opens file in notepad (likely ransom note)
PID:5612